Xiaomi

[English] Control Xiaomi Home devices via local LAN using miiocli. Supports status checks, toggling power, and MIOT property manipulation for devices like smart plugs, humidifiers, and rice cookers. | [中文] 通过局域网利用 miiocli 控制米家智能设备。支持查看状态、开关控制以及对智能插座、加湿器、电饭煲等 MIOT 设备的属性调优。

This skill claims to include helper scripts (a token extractor) and example files but those files are not in the package — that's a strong inconsistency. Before installing or running anything: 1) Do not run any token-extraction commands or paste your Xiaomi account credentials unless you can inspect the actual script code locally. 2) If you want python-miio, install it yourself (follow official project instructions) rather than running the provided one-line that hardcodes a pipx venv path. 3) Avoid storing device tokens or account credentials in plaintext files inside a project/repo; use a secure secret store. 4) Ask the publisher to provide the missing scripts and a reproducible, cross-platform install recipe (and to explain how tokens are obtained and protected). If the publisher cannot produce the missing files and transparent instructions, treat the skill as untrusted.

Type: OpenClaw Skill Name: xiaomi Version: 1.0.0 The skill is classified as benign. All described actions, including the installation of `python-miio` via `pipx` and the instruction to run a local `token_extractor.py` script, are directly and transparently aligned with the stated purpose of controlling Xiaomi Home devices locally. There is no evidence of intentional harmful behavior, data exfiltration to external endpoints, or malicious prompt injection attempts against the agent. The use of shell commands for installation and a local script for token acquisition are necessary for the skill's functionality.